Summary
A Tech.co study reveals that most senior leaders struggle to identify phishing threats, raising concerns about executive cyber awareness. As attacks grow more sophisticated, leadership must play a bigger role in strengthening security.
In today’s complex business environment, senior leaders are under constant pressure to balance strategic priorities, financial performance, and operational demands. Cyber security, though critical, often struggles to command attention until a crisis occurs. A study by Tech.co has found that a staggering 98% of senior leaders in the US are unable to correctly identify all indicators of a phishing email, raising concerns about their ability to recognise and respond to increasingly sophisticated cyber threats. “An interesting finding, but likely to be nuanced. How clear were the indicators, what was the context in which they were tested? If it really was an easy test then it is worrying, but perhaps not that surprising,” said Tim Ward, CEO of ThinkCyber. The cyber security expert added: “Business leaders have a huge number of competing priorities, and cyber sometimes only gets a look in when bad things happen. But the way in which we have trained people about this has also been flawed.”
Rather than expecting individuals to detect every possible sign of phishing, organisations should prioritise stronger governance and awareness of manipulation tactics. With AI and deepfake technology making phishing attacks more convincing, businesses must ensure that cyber criminals can only succeed by forcing employees to step outside established procedures. Crucially, leadership must take an active role in shaping a security culture that makes cyber resilience second nature. Rather than viewing cyber security as a purely technical issue, bosses should focus on reinforcing clear processes and empowering employees to recognise and resist manipulation tactics such as urgency, authority, and fear that pressure individuals into making hasty decisions. When leaders set the tone and embed security into everyday operations, businesses can better protect themselves against increasingly sophisticated threats.